In the rapidly evolving landscape of artificial intelligence, DeepSeek has emerged as a significant player, offering open-source AI models that promise cost-effective, high-performance solutions. However, its adoption brings forth substantial security concerns, primarily linked to its operations on Chinese servers.

Security Risks Due to Chinese Hosting

The major security issues with DeepSeek are intrinsically tied to its hosting and data management practices in China:

  • Massive Data Leakage: An alarming incident involved the exposure of a DeepSeek database to the public internet, discovered by security researchers at Wiz. This database, running on ClickHouse, contained over a million lines of sensitive logs, including:
    • User Chat History: Plain-text conversations between users and the AI, revealing personal information and potentially sensitive queries.
    • API Keys: Critical for accessing DeepSeek’s internal systems, these keys were left accessible, opening avenues for unauthorized system access.
    • Backend Details: Information about how DeepSeek operates, which could be exploited to understand or attack the system’s architecture.

This exposure allowed for complete administrative control over the database, meaning attackers could not only read but also modify or delete data without any authentication. The incident highlighted a severe lapse in basic security measures, with the database being found “almost immediately” by researchers using minimal scanning techniques.

  • Hackers Achieving RCE on Servers: There have been reports of hackers gaining Remote Code Execution (RCE) capabilities on DeepSeek’s servers. Such vulnerabilities could allow:
    • Execution of Arbitrary Code: Hackers could potentially run any code on DeepSeek’s servers, leading to data manipulation, further network infiltration, or the planting of malware.
    • Full System Compromise: With RCE, attackers could access, alter, or exfiltrate any data on the compromised servers, posing a severe risk to both DeepSeek and its users.

These vulnerabilities were not just theoretical; posts on X (formerly Twitter) from security researchers and ethical hackers have suggested that such exploits were indeed possible, indicating that the security infrastructure might have significant gaps:

  • Sending Data to Sanctioned China Mobile: DeepSeek has been found to transmit user data to China Mobile, a large carrier similar to AT&T, but sanctioned by the U.S. due to national security concerns:
    • Data Flow Concerns: DeepSeek’s code includes hidden programming capable of sending user data to servers controlled by China Mobile, potentially exposing user information to entities under Chinese government influence.

This situation has led to increased scrutiny from both cybersecurity experts and policymakers, with concerns over the privacy and security implications for users whose data might be routed through or stored by a sanctioned entity.

  • National Security and Geopolitical Concerns: The geopolitical dimension adds another layer of scrutiny to DeepSeek’s operations. Being based in China, the company is subject to laws that could compel it to share data with government entities, leading to:
    • Restrictions and Bans: Countries like Taiwan and Italy have banned DeepSeek’s AI for government use due to concerns over data security and potential espionage.
    • U.S. Government Wary: The U.S. military branches have also issued warnings or restrictions on using DeepSeek, highlighting the potential risks in sensitive environments.
    • Privacy Policy and Data Collection: DeepSeek’s privacy practices are under the microscope due to its extensive data collection, storing this data on Chinese servers which are subject to national intelligence laws:
      • Broad Data Collection: From chat histories to device information, DeepSeek’s privacy policy allows for the collection of a wide range of personal data, raising privacy flags.

Privately Hosted Solutions

In contrast, privately hosted versions of DeepSeek do not inherently possess these specific security issues related to Chinese hosting, as they can operate under different jurisdictional laws and with user-controlled security measures.

New Security Challenges with Self-Hosted Models

While self-hosted AI models can be much more secure, allowing organizations to control their data and security protocols, they introduce new potential security issues:

  • Sleeper Agents in AI: Research by Anthropic, detailed in their paper “Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training”, shows that self-hosted models could potentially be trained to act deceptively, only revealing malicious behavior under specific conditions. This could lead to backdoors or vulnerabilities remaining undetected even after safety training.
  • Need for Additional Security Measures:  Even with self-hosted solutions, companies should not rely solely on the security of their hosting environment. Additional security tools and services, such as those offered by WitnessAI, are crucial. These include:
    • Effective Guardrails: To prevent misuse or unintended behavior of the AI, robust guardrails are necessary. Without these, there’s a risk of the model generating harmful content, providing incorrect information, or being manipulated to bypass security protocols.
    • Real-time Monitoring: For anomaly detection and to guard against sophisticated attacks.

In conclusion, while self-hosting can mitigate many of the risks associated with external hosting, particularly those linked to geopolitical and privacy concerns, it demands a vigilant approach to security. Companies must integrate comprehensive security strategies, including the deployment of effective guardrails and advanced monitoring, to safeguard against the nuanced risks presented by AI models, including the potential for sleeper agents and other security threats.

Back to Resource Center